Skip to content

chore(policy): add the ReScript BANNED row (post-retirement sync) - #113

Merged
hyperpolymath merged 1 commit into
mainfrom
policy/banned-row-rescript
Aug 31, 2026
Merged

chore(policy): add the ReScript BANNED row (post-retirement sync)#113
hyperpolymath merged 1 commit into
mainfrom
policy/banned-row-rescript

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Aug 31, 2026

Copy link
Copy Markdown
Owner

Estate-wide policy sync (task: BANNED-row campaign, 2026-08-31).

ReScript is retired outside the enclave (owner ruling 2026-08-31: rescript, rescript-ecosystem, and the proven adapters stay ReScript; nothing else). This repo's language-policy table in .claude/CLAUDE.md predated that ruling.

  • Adds | ReScript | AffineScript | to the BANNED table (whole-line insert after the TypeScript row, extra columns mirrored).
  • Where the Python row still recommended ReScript as a replacement, rewrites it to AffineScript.

Doc-only change; verified estate-wide by an origin-side GraphQL scan of all 428 non-archived repos (52 repos in this sweep).

🤖 Generated with Claude Code

@hyperpolymath @claude
chore(policy): add the ReScript BANNED row (post-retirement sync)
a9d9854 
ReScript is retired estate-wide (enclave ruling 2026-08-31: only the
rescript/rescript-ecosystem/proven-adapter repos remain ReScript). This syncs
the language-policy BANNED table: adds | ReScript | AffineScript | after the
TypeScript row, and where present rewrites the Python replacement row to no
longer recommend ReScript.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 2ff6a405-3db4-4e3c-a572-d1ae62247b2f

📥 Commits

Reviewing files that changed from the base of the PR and between beb9b4d and a9d9854.

📒 Files selected for processing (1)
  • .claude/CLAUDE.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⚠️ CI failures not shown inline (24)

GitHub Actions: Central Estate CI/CD Audit / 0_estate-audit.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # Presence-only checking rewards filler. This gate previously demanded
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- presence, accepting every policy-legal form -------------------�[0m
 �[36;1m# "name:form1,form2,..." — first existing form wins.�[0m
 �[36;1mdeclare -a required=(�[0m
 �[36;1m  ".editorconfig:.editorconfig"�[0m
 �[36;1m  ".gitignore:.gitignore"�[0m
 �[36;1m  ".gitattributes:.gitattributes"�[0m
 �[36;1m  "CODEOWNERS:CODEOWNERS,.github/CODEOWNERS,docs/CODEOWNERS"�[0m
 �[36;1m  "GOVERNANCE:GOVERNANCE.adoc,GOVERNANCE.md"�[0m
 �[36;1m  "ARCHITECTURE:ARCHITECTURE.adoc,ARCHITECTURE.md,docs/architecture/README.adoc,TOPOLOGY.adoc,TOPOLOGY.md"�[0m
 �[36;1m  "MAINTAINERS:MAINTAINERS,MAINTAINERS.adoc,MAINTAINERS.md"�[0m
 �[36;1m  "toolchain:.tool-versions,.mise.toml,mise.toml"�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1mdeclare -A found=()�...

GitHub Actions: Dashboard Check / 0_STATE vs dashboard reconciliation.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Central Estate CI/CD Audit / estate-audit: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # Presence-only checking rewards filler. This gate previously demanded
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- presence, accepting every policy-legal form -------------------�[0m
 �[36;1m# "name:form1,form2,..." — first existing form wins.�[0m
 �[36;1mdeclare -a required=(�[0m
 �[36;1m  ".editorconfig:.editorconfig"�[0m
 �[36;1m  ".gitignore:.gitignore"�[0m
 �[36;1m  ".gitattributes:.gitattributes"�[0m
 �[36;1m  "CODEOWNERS:CODEOWNERS,.github/CODEOWNERS,docs/CODEOWNERS"�[0m
 �[36;1m  "GOVERNANCE:GOVERNANCE.adoc,GOVERNANCE.md"�[0m
 �[36;1m  "ARCHITECTURE:ARCHITECTURE.adoc,ARCHITECTURE.md,docs/architecture/README.adoc,TOPOLOGY.adoc,TOPOLOGY.md"�[0m
 �[36;1m  "MAINTAINERS:MAINTAINERS,MAINTAINERS.adoc,MAINTAINERS.md"�[0m
 �[36;1m  "toolchain:.tool-versions,.mise.toml,mise.toml"�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1mdeclare -A found=()�...

GitHub Actions: Dashboard Check / STATE vs dashboard reconciliation: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run if [[ -z $toolchain ]]; then
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / 0_scan _ rust-secrets.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / scan _ rust-secrets: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / 1_scan _ shell-secrets.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Secret Scanner / scan _ shell-secrets: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Dogfood Gate / 1_Validate A2ML manifests.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 29 .a2ml file(s)
   Validating: ./.machine_readable/6a2/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/anchor/ANCHOR.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/bot_directives/coverage.a2ml
   Validating: ./.machine_readable/bot_directives/debt.a2ml
   Validating: ./.machine_readable/bot_directives/git-private-farm.a2ml
   Validating: ./.machine_readable/bot_directives/gitbot-fleet.a2ml
   Validating: ./.machine_readable/bot_directives/hypatia.a2ml
   Validating: ./.machine_readable/bot_directives/methodology.a2ml
   Validating: ./.machine_readable/contractiles/Adjustfile.a2ml
   Validating: ./.machine_readable/contractiles/Bustfile.a2ml
   Validating: ./.machine_readable/contractiles/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/threat-model.a2ml
   Validating: ./0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
 ##[war...

GitHub Actions: Secret Scanner / 2_scan _ gitleaks.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

GitHub Actions: Dogfood Gate / Validate A2ML manifests: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 29 .a2ml file(s)
   Validating: ./.machine_readable/6a2/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/anchor/ANCHOR.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/bot_directives/coverage.a2ml
   Validating: ./.machine_readable/bot_directives/debt.a2ml
   Validating: ./.machine_readable/bot_directives/git-private-farm.a2ml
   Validating: ./.machine_readable/bot_directives/gitbot-fleet.a2ml
   Validating: ./.machine_readable/bot_directives/hypatia.a2ml
   Validating: ./.machine_readable/bot_directives/methodology.a2ml
   Validating: ./.machine_readable/contractiles/Adjustfile.a2ml
   Validating: ./.machine_readable/contractiles/Bustfile.a2ml
   Validating: ./.machine_readable/contractiles/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/threat-model.a2ml
   Validating: ./0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
 ##[war...

GitHub Actions: Secret Scanner / scan _ gitleaks: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mMIRROR="$RUNNER_TEMP/adoc-mirror"�[0m
 �[36;1mREPORT="$RUNNER_TEMP/adoc-report.json"�[0m
 �[36;1mrm -rf "$MIRROR"; mkdir -p "$MIRROR"�[0m
 �[36;1m�[0m
 �[36;1m# -print0/read -d '' so paths with spaces or newlines survive; the�[0m
 �[36;1m# estate has directories with spaces in them.�[0m
 �[36;1mfound=0�[0m
 �[36;1mwhile IFS= read -r -d '' f; do�[0m
 �[36;1m  dest="$MIRROR/$(dirname "$f")"�[0m
 �[36;1m  mkdir -p "$dest"�[0m
 �[36;1m  cp "$f" "$dest/$(basename "$f").txt"�[0m
 �[36;1m  found=$((found + 1))�[0m
 �[36;1mdone < <(find . -path ./.git -prune -o \�[0m
 �[36;1m              \( -name '*.adoc' -o -name '*.asciidoc' \) -type f -print0)�[0m
 �[36;1m�[0m
 �[36;1mif [ "$found" -eq 0 ]; then�[0m
 �[36;1m  echo "No AsciiDoc files present — nothing to scan."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mecho "Scanning $found AsciiDoc file(s) via mirror."�[0m
 �[36;1m�[0m
 �[36;1m# Honour the caller's own baseline when it has one, so repo-specific�[0m
 �[36;1m# allowlists still apply to docs exactly as they do to code — and�[0m
 �[36;1m# otherwise fall back to the estate baseline, so docs and code are�[0m
 �[36;1m# judged by the SAME rules. Previously this step honoured a repo�[0m
 �[36;1m# config while the code scan above honoured none, which meant an�[0m
 �[36;1m# allowlist entry could suppress a finding in a `.adoc` file and not�[0m
 �[36;1m# in the `.md` file beside it.�[0m
 �[36;1m#�[0m
 �[36;1m# Absolute paths: this scan's --source is the MIRROR directory, so a�[0m
 �[36;1m# relative config path would resolve against the mirror rather than�[0m
 �[36;1m# the repository. `[extend] path = ".gitleaks-estate.toml"` inside a�[0m
 �[36;1m# repo config resolves against the process CWD (still the repo root),�[0m
 �[36;1m# which is why the estate baseline is staged there.�[0m
 �[36;1mconfig_args=(--config "$PWD/.gitleaks-estate.toml")�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;...

GitHub Actions: Dogfood Gate / 4_Groove manifest check.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Governance / 5_governance _ Security policy checks.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / governance _ Security policy checks: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 7_governance _ Workflow security linter.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run failed=0
 �[36;1mfailed=0�[0m
 �[36;1mfor file in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$file" ] || continue�[0m
 �[36;1m  # ⚠ SCAN THE HEADER BLOCK, NOT LINE 1. REUSE places the identifier�[0m
 �[36;1m  # anywhere in a file's leading comment block, and `gh actions-lock`�[0m
 �[36;1m  # INSERTS `# This workflow is managed by gh actions-lock.` at line 1�[0m
 �[36;1m  # whenever it mints a lockfile — so a line-1 test fights the estate's�[0m
 �[36;1m  # own tool and re-fails every time a lockfile is refreshed.�[0m
 �[36;1m  #�[0m
 �[36;1m  # Measured 2026-08-07: it reported 27 hypatia workflows and 13 more�[0m
 �[36;1m  # elsewhere as missing a header they all had, and "fixing" that by�[0m
 �[36;1m  # prepending a default MIS-LICENSED three files (PMPL-1.0-or-later�[0m
 �[36;1m  # shadowed by MPL-2.0) before it was caught.�[0m
 �[36;1m  #�[0m
 �[36;1m  # The leading run of comment lines is read, tolerating a YAML�[0m
 �[36;1m  # document marker. A licence declared there is declared.�[0m
 �[36;1m  if ! awk '/^---[[:space:]]*$/ { next } /^`#/` { print; next } { exit }' "$file" \�[0m
 �[36;1m       | grep -q "^# SPDX-License-Identifier:"; then�[0m
 �[36;1m    echo "ERROR: $file has no SPDX-License-Identifier in its header comment block"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1m  if ! grep -q "^permissions:" "$file"; then�[0m
 �[36;1m    echo "ERROR: $file missing top-level 'permissions:' declaration"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1m[ $failed -eq 1 ] && { echo "Add SPDX header + permissions:"; exit 1; }�[0m
 �[36;1mecho "All workflows have SPDX headers + permissions"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/main-estate-audit.yml has no SPDX-License-Identifier in its header comment block
 ERROR: .github/workflows/main-estate-audit.yml missing top-level 'permissions:' declaration
 Add SPDX header + permissions:
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 9_governance _ Allowlist Preflight.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/januskey
 ##[error]Process completed with exit code 3.

GitHub Actions: Governance / governance _ Allowlist Preflight: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/januskey
 ##[error]Process completed with exit code 3.

GitHub Actions: Governance / 12_governance _ Well-Known (RFC 9116 + RSR).txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m
🔇 Additional comments (1)
.claude/CLAUDE.md (1)

41-41: LGTM!

Also applies to: 47-47

📝 Walkthrough

Summary by CodeRabbit

  • Documentation
    • Updated project guidance to recommend AffineScript as the replacement option where ReScript was previously listed.
    • Clarified the approved language alternatives in the “Banned - Do Not Use” guidance.

Walkthrough

The project guidance now bans ReScript and lists AffineScript as its replacement. The Python replacement entry also changes from Julia/Rust/ReScript to Julia/Rust/AffineScript.

Changes

Tool policy update

Layer / File(s) Summary
Banned-tools table update
.claude/CLAUDE.md		 The table adds a ReScript ban with AffineScript as the replacement. The Python replacement changes to Julia/Rust/AffineScript.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to a9d98

This localized documentation-only policy update has no actionable merge-blocking risk and is merge-ready after normal checks and review.

Poem

A rabbit checked the table with care
ReScript found a warning there
AffineScript took its place
Python gained a matching trace
Two small lines now guide the way

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description check ✅ Passed The description clearly explains the ReScript policy update, the AffineScript replacement, the exemption scope, and the documentation-only change.
Title check ✅ Passed The title clearly identifies the policy change and the post-retirement synchronisation. It is concise and relevant to the main change.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit a745492 into main Aug 31, 2026
26 of 32 checks passed
@hyperpolymath
hyperpolymath deleted the policy/banned-row-rescript branch August 31, 2026 20:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath